trestnet.advisorsdocxview.click Open in urlscan Pro
168.100.8.29 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://trestnet.advisorsdocxview.click/
Effective URL:
https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On November 07 via api (November 7th 2024, 2:27:05 am UTC) from US — Scanned from NL

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 168.100.8.29, located in Amsterdam, Netherlands and belongs to BLNWX, US. The main domain is trestnet.advisorsdocxview.click.
TLS certificate: Issued by E5 on November 4th 2024. Valid for: 3 months.

This is the only time trestnet.advisorsdocxview.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
3 16	168.100.8.29 168.100.8.29		399629 (BLNWX) (BLNWX)
14	2

16 168.100.8.29 (Amsterdam, Netherlands) 3 redirects

ASN399629 (BLNWX, US)

trestnet.advisorsdocxview.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0ffice.advisorsdocxview.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
905a968f-29fd13fe.advisorsdocxview.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
l1ve.advisorsdocxview.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	advisorsdocxview.click 3 redirects trestnet.advisorsdocxview.click 0ffice.advisorsdocxview.click 905a968f-29fd13fe.advisorsdocxview.click l1ve.advisorsdocxview.click	433 KB
14	1

	Domain	Requested by
10	905a968f-29fd13fe.advisorsdocxview.click	trestnet.advisorsdocxview.click 905a968f-29fd13fe.advisorsdocxview.click
4	trestnet.advisorsdocxview.click	2 redirects
1	l1ve.advisorsdocxview.click	trestnet.advisorsdocxview.click 905a968f-29fd13fe.advisorsdocxview.click
1	0ffice.advisorsdocxview.click	1 redirects
14	4

This site contains links to these domains. Also see Links.

Domain
wwwms.advisorsdocxview.click
66eda528-29fd13fe.advisorsdocxview.click

Subject Issuer	Validity	Valid
advisorsdocxview.click E5	`2024-11-04` - `2025-02-02`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
Frame ID: BCD176F0C8958E39C45B73E1164F47B3
Requests: 13 HTTP requests in this frame

Frame: https://l1ve.advisorsdocxview.click/Me.htm?v=3
Frame ID: 119C453F2860E9200CC6D02C02127B72
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Aanmelden bij uw account

Page URL History Show full URLs

https://trestnet.advisorsdocxview.click/ Page URL
https://trestnet.advisorsdocxview.click/ HTTP 302
https://trestnet.advisorsdocxview.click/ HTTP 302
https://0ffice.advisorsdocxview.click/login HTTP 302
https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

14
Requests

93 %
HTTPS

0 %
IPv6

1
Domains

4
Subdomains

2
IPs

1
Countries

417 kB
Transfer

1376 kB
Size

7
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://wwwms.advisorsdocxview.click/nl-NL/servicesagreement/
Title: Gebruiksvoorwaarden

Search URL Search Domain Scan URL

URL: https://66eda528-29fd13fe.advisorsdocxview.click/nl-NL/privacystatement
Title: Privacy en cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trestnet.advisorsdocxview.click/ Page URL
https://trestnet.advisorsdocxview.click/ HTTP 302
https://trestnet.advisorsdocxview.click/ HTTP 302
https://0ffice.advisorsdocxview.click/login HTTP 302
https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response trestnet.advisorsdocxview.click/	162 KB 62 KB	504ms 163ms	Document text/html	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://trestnet.advisorsdocxview.click/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `b6772cdff7b797870d9e1d574bbb1698c2ce2c0e3748f64af1b7ee5f80066ef3` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Thu, 07 Nov 2024 02:27:00 GMT server nginx vary Accept-Encoding
GET H2	200	Primary Request authorize Show response trestnet.advisorsdocxview.click/common/oauth2/v2.0/ Redirect Chain https://trestnet.advisorsdocxview.click/ https://trestnet.advisorsdocxview.click/ https://0ffice.advisorsdocxview.click/login https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_typ...	177 KB 63 KB	581ms 580ms	Document text/html	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `09b0fa5c60906ca0b3df82e88ab56b8e70dceb5dd47da38566a68f75c3ca445e` Request headers Content-Type application/x-www-form-urlencoded Origin https://trestnet.advisorsdocxview.click Referer https://trestnet.advisorsdocxview.click/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-allow-headers * access-control-allow-origin * cache-control no-store, no-cache content-encoding gzip content-length 64161 content-type text/html; charset=utf-8 date Thu, 07 Nov 2024 02:27:02 GMT nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://51443cc7-29fd13fe.advisorsdocxview.click/api/report?catId=GW+estsfd+dub2"}]} server nginx vary Accept-Encoding x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.19343.4 - FRC ProdSlices x-ms-request-id fca2c235-22de-40c9-86fd-6ca3fe28cb00 x-ms-srs 1.P Redirect headers access-control-allow-headers * access-control-allow-origin * content-encoding gzip content-length 20 content-type text/html; charset=utf-8 date Thu, 07 Nov 2024 02:27:01 GMT location https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 referrer-policy strict-origin-when-cross-origin request-context appId= server nginx vary Accept-Encoding x-cache CONFIG_NOCACHE x-msedge-ref Ref A: 862B029616AB42E88488CAACA0E8F517 Ref B: AMS231032605045 Ref C: 2024-11-07T02:27:01Z x-ua-compatible IE=edge,chrome=1
GET H2	200	converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css 905a968f-29fd13fe.advisorsdocxview.click/ests/2.1/content/cdnbundles/	111 KB 20 KB	443ms 373ms	Stylesheet text/css	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://905a968f-29fd13fe.advisorsdocxview.click/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css Requested by Host: trestnet.advisorsdocxview.click URL: https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `68c2994e21a564345eb3b4091dd2334c9cbddb0aecda45ee963c6de2e1629b93` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://trestnet.advisorsdocxview.click Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DCDDAAF34D1A25 content-encoding gzip x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:02 GMT content-type text/css last-modified Wed, 25 Sep 2024 21:42:27 GMT cache-control public, max-age=31536000 x-ms-request-id c6524bc2-d01e-0009-7765-2eb928000000 accept-ranges bytes access-control-allow-origin * content-length 20400 x-azure-ref 20241107T022702Z-r1cf5f84dd64rmbdhC1DUSa05n000000042000000000yydd x-ms-blob-type BlockBlob server nginx
GET H2	200	ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js Show response 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/	439 KB 120 KB	912ms 843ms	Script application/x-javascript	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js Requested by Host: trestnet.advisorsdocxview.click URL: https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `8f09269d324fca95bc9a47a2b9ffeea8697f66cf3420366213f7bd5e7021b10f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://trestnet.advisorsdocxview.click Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DCE4DDB9B391BE content-encoding gzip x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:03 GMT content-type application/x-javascript last-modified Sat, 05 Oct 2024 01:33:33 GMT cache-control public, max-age=31536000 x-ms-request-id c4bd1c5f-501e-0023-4565-2e2e2a000000 accept-ranges bytes access-control-allow-origin * content-length 122351 x-azure-ref 20241107T022702Z-r1cf5f84dd65gs7thC1DUSa760000000029000000000qkez x-ms-blob-type BlockBlob server nginx
GET H2	200	ux.converged.login.strings-nl.min_hhykflc3phtvjc9hx9bnpw2.js Show response 905a968f-29fd13fe.advisorsdocxview.click/ests/2.1/content/cdnbundles/	60 KB 17 KB	381ms 312ms	Script application/x-javascript	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://905a968f-29fd13fe.advisorsdocxview.click/ests/2.1/content/cdnbundles/ux.converged.login.strings-nl.min_hhykflc3phtvjc9hx9bnpw2.js Requested by Host: trestnet.advisorsdocxview.click URL: https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `ad0b42e0d41a9748101f0d1406249cf4fbe56f782feb580eac1723ec76a93f35` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://trestnet.advisorsdocxview.click Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DCC6D5384562AD content-encoding gzip x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:02 GMT content-type application/x-javascript last-modified Tue, 27 Aug 2024 20:17:05 GMT cache-control public, max-age=31536000 x-ms-request-id d9305366-c01e-000e-0875-2e9d59000000 accept-ranges bytes access-control-allow-origin * content-length 17237 x-azure-ref 20241107T022702Z-r1cf5f84dd6nxvvlhC1DUS15pc00000003qg000000006tum x-ms-blob-type BlockBlob server nginx
GET H2	200	Me.htm l1ve.advisorsdocxview.click/	0 0	728ms 694ms	Other text/html	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://l1ve.advisorsdocxview.click/Me.htm?v=3 Requested by Host: trestnet.advisorsdocxview.click URL: https://trestnet.advisorsdocxview.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.advisorsdocxview.click%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.advisorsdocxview.click%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665432217278789.NGM1YjAzYzQtY2IxNC00NzVjLWIxZDgtOWI3ZTkzZDhkOWUwOWE5OTc3NDktMGEyYi00NmRiLWFhNmItMTEwN2FiYmFhNWUw&ui_locales=nl-NL&mkt=nl-NL&client-request-id=0c8f9722-dca1-4f9d-bef9-a9bdb1ea5814&state=kfyrdJqm2itXmPMUICru-hYfDUWFreuJ9W0nLXzPkbbJcYC_Ia5YSh00LK0PdctgVh-xF5h_NAIuZjJ04i8yno-QETsdDjwNkhUtdJKG8bZdJep1eEv0EBnlSOpScITC2kvhDV8XjUMlgERbCERTbQfWdI1NX8NKPMsLmdgSwhwDr0FVoc2kC3zEHZqr1LXH-2bB-lVr5cWd3ftbyHnCghSUFGPH137EdU2f1FXW4ZRBeNjU_6aNi7YpcsF04Fs1RmxAdIPXgqm7WHKn_JW_5A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers
GET H2	200	convergedlogin_pcustomizationloader_117b650bccea354984d8.js Show response 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/asyncchunk/	398 KB 114 KB	650ms 649ms	Script application/x-javascript	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js Requested by Host: 905a968f-29fd13fe.advisorsdocxview.click URL: https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `c1f177beaf08bf9dabfd558ccea9b60da593206260d194ded58ab07fac14e40f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DCBD5317046A2F content-encoding gzip x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:04 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:52:54 GMT cache-control public, max-age=31536000 x-ms-request-id d978f820-f01e-0058-4357-2c6cb6000000 accept-ranges bytes access-control-allow-origin * content-length 116461 x-azure-ref 20241107T022703Z-r198b659b8bspvlhhC1AM13r7400000008r0000000003c2s x-ms-blob-type BlockBlob server nginx
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/	2 KB 3 KB	290ms 290ms	Other image/x-icon	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `62d706019a0d80173113ef70fbbee12f286e8e221534be788448aada4b14c8e8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8D8731230C851A6 x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:03 GMT content-type image/x-icon last-modified Sun, 18 Oct 2020 03:02:03 GMT cache-control public, max-age=31536000 x-ms-request-id f6a32521-a01e-004d-6157-2c0cba000000 accept-ranges bytes access-control-allow-origin * x-azure-ref 20241107T022703Z-r198b659b8b6x6qnhC1AM1y1w400000009a00000000021x0 x-ms-blob-type BlockBlob server nginx
GET H2	200	convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Show response 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	324ms 324ms	Script application/x-javascript	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Requested by Host: 905a968f-29fd13fe.advisorsdocxview.click URL: https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/js/ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `8bd5f07c6db3100cfbd38b83ec234561709a0326a4d1567ee1a4ac810db4fd37` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DCBD531731891C content-encoding gzip x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:04 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:52:54 GMT cache-control public, max-age=31536000 x-ms-request-id 65c41b1c-901e-0061-6566-2e97aa000000 accept-ranges bytes access-control-allow-origin * content-length 5543 x-azure-ref 20241107T022704Z-r1cf5f84dd6wmk4qhC1DUShgsg00000003c000000000yu3s x-ms-blob-type BlockBlob server nginx
GET H2	200	marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/	3 KB 3 KB	285ms 284ms	Image image/gif	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DB5C3F48EC4154 x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:04 GMT content-type image/gif last-modified Wed, 24 May 2023 10:11:47 GMT cache-control public, max-age=31536000 x-ms-request-id 12439250-c01e-0053-3965-2e97dd000000 accept-ranges bytes access-control-allow-origin * x-azure-ref 20241107T022704Z-r1cf5f84dd64rmbdhC1DUSa05n000000043g00000000pu7u x-ms-blob-type BlockBlob server nginx
GET H2	200	marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/	4 KB 4 KB	253ms 253ms	Image image/gif	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DB5C3F4904824B x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:04 GMT content-type image/gif last-modified Wed, 24 May 2023 10:11:48 GMT cache-control public, max-age=31536000 x-ms-request-id bd6cd05f-b01e-0033-59b2-2b9cfd000000 accept-ranges bytes access-control-allow-origin * x-azure-ref 20241107T022704Z-r198b659b8b2pmgwhC1AM1b5g8000000093g000000000zvv x-ms-blob-type BlockBlob server nginx
GET H2	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/backgrounds/	2 KB 1 KB	252ms 252ms	Image image/svg+xml	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DB5C3F47E260FD content-encoding gzip x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:04 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:46 GMT cache-control public, max-age=31536000 x-ms-request-id ffa0c588-101e-0050-2b6f-2e76b9000000 accept-ranges bytes access-control-allow-origin * x-azure-ref 20241107T022704Z-r1cf5f84dd6ltwlkhC1DUS5rz800000002d0000000003856 x-ms-blob-type BlockBlob server nginx
GET H2	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg 905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/	4 KB 2 KB	247ms 246ms	Image image/svg+xml	168.100.8.29 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://905a968f-29fd13fe.advisorsdocxview.click/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.100.8.29 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://trestnet.advisorsdocxview.click/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DB5C3F4911527F content-encoding gzip x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Thu, 07 Nov 2024 02:27:04 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:48 GMT cache-control public, max-age=31536000 x-ms-request-id bebe716e-201e-0064-71dc-2f4571000000 accept-ranges bytes access-control-allow-origin * x-azure-ref 20241107T022704Z-r1cf5f84dd6vnd2shC1DUSzy0w00000002ag00000000smnf x-ms-blob-type BlockBlob server nginx
GET		Me.htm l1ve.advisorsdocxview.click/ Frame 119C	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: l1ve.advisorsdocxview.click
URL: https://l1ve.advisorsdocxview.click/Me.htm?v=3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.advisorsdocxview.click/	1969-12-31 23:59:59	Name: hWJI11 Value: "MjlmZDEzZmUtMTFiOS00MTQ2LTllMjUtMTliY2Y5YzM5NTE2OmQ3ZDRmYWQ1LTI0MjktNDA2Mi05ZmMzLTlkNGMyOGU2ODRkNQ=="
0ffice.advisorsdocxview.click/	1970-01-21 10:25:06	Name: OH.DCAffinity Value: OH-weu
0ffice.advisorsdocxview.click/	1970-01-21 10:25:06	Name: OH.FLID Value: 74ec67e1-08f5-458a-af27-e214713ece25
0ffice.advisorsdocxview.click/	1970-01-21 10:25:06	Name: .AspNetCore.OpenIdConnect.Nonce.FPkZRFxhL-mLV288OyuZ4N-2WIhCYQKTFX3floKMVt6Z9QtuLl1FHjmzT-1LF3cI-1ZCf3_R3vlBYEBi5vYlyMngyf9QGVUTp9KYLAVHQzMIhy4uIk_i_QCwLoYUduBEeU3HST2JySmHoqWMbq0k2TyNZ9ArSqRWh-WH4il-9AbaX1NKiKeqTHnFQ3_0XJ1sm-gflYIBslMkJU2tOr3-yIosLzoTDuFpSULtT56sfL_2uo6TJphkczpZEVPlIhgE Value: N
0ffice.advisorsdocxview.click/	1970-01-21 10:25:06	Name: .AspNetCore.Correlation.eDYaurVbjbwqWBjM7v1qPYM0jlGWUeQQJpucoxR5x6c Value: N
.advisorsdocxview.click/	1970-01-21 10:25:06	Name: MUID Value: 0555667C5B8561C42158734C5A5D6055
.trestnet.advisorsdocxview.click/	1970-01-21 10:10:42	Name: brcap Value: 0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://trestnet.advisorsdocxview.click/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A070B203AC140000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://trestnet.advisorsdocxview.click/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A020BF03AC140000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0ffice.advisorsdocxview.click
905a968f-29fd13fe.advisorsdocxview.click
l1ve.advisorsdocxview.click
trestnet.advisorsdocxview.click
l1ve.advisorsdocxview.click
168.100.8.29
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
09b0fa5c60906ca0b3df82e88ab56b8e70dceb5dd47da38566a68f75c3ca445e
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
62d706019a0d80173113ef70fbbee12f286e8e221534be788448aada4b14c8e8
68c2994e21a564345eb3b4091dd2334c9cbddb0aecda45ee963c6de2e1629b93
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8bd5f07c6db3100cfbd38b83ec234561709a0326a4d1567ee1a4ac810db4fd37
8f09269d324fca95bc9a47a2b9ffeea8697f66cf3420366213f7bd5e7021b10f
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
ad0b42e0d41a9748101f0d1406249cf4fbe56f782feb580eac1723ec76a93f35
b6772cdff7b797870d9e1d574bbb1698c2ce2c0e3748f64af1b7ee5f80066ef3
c1f177beaf08bf9dabfd558ccea9b60da593206260d194ded58ab07fac14e40f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

trestnet.advisorsdocxview.click Open in urlscan Pro 168.100.8.29 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

14 Requests

93 %HTTPS

0 %IPv6

1 Domains

4 Subdomains

2 IPs

1 Countries

417 kBTransfer

1376 kBSize

7 Cookies

2 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

23 JavaScript Global Variables

7 Cookies

2 Console Messages

Indicators

trestnet.advisorsdocxview.click Open in urlscan Pro
168.100.8.29 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

0 %
IPv6

1
Domains

4
Subdomains

2
IPs

1
Countries

417 kB
Transfer

1376 kB
Size

7
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!